“Cyber resilience is becoming the defining infrastructure of the twenty first century. Nations that invest in protecting their digital foundations will be the ones that keep their lights on, their water flowing, and their economies moving.” – MJ Martin
A New Cost of Doing Business
For years, cybersecurity was often viewed as an information technology issue. Today, it has become a boardroom issue, an operational issue, and increasingly a matter of national resilience. IBM’s 2026 Cost of a Data Breach Report reveals that Canadian organizations are now experiencing the highest average data breach costs ever recorded, reaching CA$7.11 million per incident. That figure represents more than the financial cost of stolen data. It reflects production interruptions, damaged reputations, regulatory consequences, legal exposure, customer distrust, and the long and expensive process of recovery. The report sends a clear message that cyber attacks have become an unavoidable business risk requiring strategic leadership rather than reactive technical fixes.
Critical Infrastructure Under Attack
The most striking finding is not simply the rising cost of cybercrime. It is where attackers are concentrating their efforts. According to IBM, Canada’s energy sector has become the country’s most expensive industry for cyber breaches, averaging CA$9.21 million per incident. Technology organizations follow closely at CA$9.02 million, while industrial organizations average CA$8.89 million. These sectors form the backbone of Canada’s economy, supporting electricity generation, oil and gas production, manufacturing, telecommunications, municipal utilities, and transportation.
Think of Canada’s critical infrastructure as the circulatory system of the human body. Electricity, water, communications, transportation, and industrial production function like arteries carrying the resources that keep the nation alive. A blockage or injury in one location rarely remains isolated. The effects ripple throughout the entire body. Likewise, a successful cyber attack against a major utility or industrial supplier can cascade across provinces, municipalities, businesses, and consumers.
For Canada’s water, gas, and electric utilities, this is particularly significant. Smart meters, SCADA systems, cloud platforms, communications networks, mobile workforces, and artificial intelligence have dramatically improved operational efficiency. Yet every new digital connection also becomes another potential doorway that adversaries may attempt to exploit.
The Weakest Link is Often Someone Else
IBM identifies supply chain compromise as Canada’s single largest contributor to breach costs, adding approximately CA$367,899 to the average incident. Organizations frequently invest heavily in protecting their own networks while overlooking the cyber maturity of contractors, software vendors, equipment suppliers, consultants, and cloud service providers.
This resembles securing every door and window of your own house while leaving the connecting garage door unlocked. Criminals naturally seek the easiest point of entry rather than attacking the strongest defence.
Utilities and municipalities increasingly depend upon interconnected ecosystems of technology vendors, field service providers, communications companies, software developers, and cloud infrastructure partners. Cybersecurity therefore becomes a shared responsibility extending well beyond organizational boundaries.
Artificial Intelligence Changes the Equation
Perhaps the most encouraging finding from the IBM report is the measurable value of artificial intelligence when deployed responsibly. Canadian organizations extensively using AI and security automation reported average breach costs of CA$5.5 million, compared with CA$8.91 million among organizations with little or no AI deployment. That represents an average savings of approximately CA$3.41 million per breach.
The operational benefits are equally compelling. Organizations using AI detected breaches in 124 days and contained them in 57 days, compared with 154 days and 71 days respectively for organizations without extensive AI adoption.
These findings illustrate an important principle. Artificial intelligence should not be viewed as replacing cybersecurity professionals. Instead, it functions like an experienced air traffic controller, continuously monitoring thousands of signals simultaneously while directing human experts toward the most urgent risks. AI provides speed, consistency, and pattern recognition, while experienced security analysts contribute judgment, investigation, and decision making.
However, AI is also becoming a weapon for cybercriminals. IBM reports that 28 percent of Canadian organizations experienced AI generated attacks. This creates an accelerating technological competition where defenders and attackers are both leveraging increasingly sophisticated automation.
Canada’s Next Cybersecurity Challenge
Cyber resilience is rapidly becoming as essential as physical infrastructure maintenance. Every municipality, utility, healthcare organization, manufacturer, and energy provider must assume that cyber attacks are not hypothetical possibilities but operational realities requiring continuous preparation. Identity management, supplier oversight, employee education, incident response exercises, and AI enabled security operations are becoming essential investments rather than discretionary expenses.
Canada has an opportunity to become a global leader in protecting critical infrastructure through collaboration between governments, utilities, technology providers, and educational institutions. The cost of prevention is increasingly proving to be far less than the cost of recovery.
The IBM findings raise important questions for Canadian leaders. If artificial intelligence can reduce breach costs by millions of dollars, what prevents broader adoption across critical infrastructure? Should cybersecurity requirements extend more deeply into vendor qualification and procurement processes? As municipalities modernize water, gas, and electrical systems, should cyber resilience receive the same priority as physical reliability? These questions will define not only Canada’s digital future but also the resilience of the essential services upon which every Canadian depends.
Sources
IBM Canada. 2026 Cost of a Data Breach Report, news release, July 29, 2026. Based on research conducted by the Ponemon Institute involving 602 organizations globally between March 2025 and February 2026.
About the Author:
Michael Martin is the Vice President of Technology with Metercor Inc., a Smart Meter, IoT, and Smart City systems integrator based in Canada. He has more than 40 years of experience in systems design for applications that use broadband networks, optical fibre, wireless, and digital communications technologies. He is a business and technology consultant. He was a senior executive consultant for 15 years with IBM, where he worked in the GBS Global Center of Competency for Energy and Utilities and the GTS Global Center of Excellence for Energy and Utilities. He is a founding partner and President of MICAN Communications and before that was President of Comlink Systems Limited and Ensat Broadcast Services, Inc., both divisions of Cygnal Technologies Corporation (CYN: TSX).
Martin served on the Board of Directors for TeraGo Inc (TGO: TSX) and on the Board of Directors for Avante Logixx Inc. (XX: TSX.V). He has served as a Member, SCC ISO-IEC JTC 1/SC-41 – Internet of Things and related technologies, ISO – International Organization for Standardization, and as a member of the NIST SP 500-325 Fog Computing Conceptual Model, National Institute of Standards and Technology. He served on the Board of Governors of the University of Ontario Institute of Technology (UOIT) [now Ontario Tech University] and on the Board of Advisers of five different Colleges in Ontario – Centennial College, Humber College, George Brown College, Durham College, Ryerson Polytechnic University [now Toronto Metropolitan University]. For 16 years he served on the Board of the Society of Motion Picture and Television Engineers (SMPTE), Toronto Section.
He holds three master’s degrees – in business (MBA), communication (MA), and education (MEd). As well, he has three undergraduate diplomas and seven major certifications in business, computer programming, internetworking, project management, media, photography, and communication technology. He has completed over 80 next generation MOOC (Massive Open Online Courses) [aka Micro Learning] continuous education programs in a wide variety of topics, including: Economics, Python Programming, Internet of Things, Cloud, Artificial Intelligence and Cognitive systems, Blockchain, Agile, Power BI, Big Data, Design Thinking, Security, Indigenous Canada awareness, and more.
Martin in a volunteer, a photographer, a learner, a technologist, a philosophizer, and a romantic optimist.